What Is GLBA? Privacy Notices, Opt-Outs & Safeguards

It can apply when the business is a financial institution under GLBA's functional definition and the relevant activity is significantly engaged in financial activities. A brand name or app category is not enough; check the institution's role, product, regulator, and current privacy notice.

Each financial institution must provide an opt-out method in its annual privacy notice, typically a checkbox, toll-free number, or URL. The opt-out applies to sharing with non-affiliated third parties and must remain effective until revoked. Note: the opt-out does NOT cover sharing with affiliates (other companies under common ownership) or service providers performing the institution's own functions.

No. GLBA has no express preemption of stronger state laws. A state like California (CCPA) can impose additional requirements on GLBA-covered institutions for the non-GLBA portions of their business (e.g., marketing data that is not NPI). Financial institutions must comply with both.

The Safeguards Rule (16 CFR Part 314) applies to financial institutions under FTC jurisdiction, including non-bank businesses significantly engaged in financial activities such as mortgage lending, loan brokering, payday lending, finance, auto financing, check cashing, tax preparation, credit counseling, and some investment-advisory or debt-collection activities. Covered businesses must designate a qualified individual to run the security program, perform a written risk assessment, encrypt customer data in transit and at rest, require multi-factor authentication, monitor and test systems, oversee service providers, and maintain an incident-response plan. Since May 2024, a covered institution must also notify the FTC as soon as possible and no later than 30 days after discovery of a notification event involving unauthorized acquisition of unencrypted information of 500 or more consumers. Institutions holding information on fewer than 5,000 consumers are exempt from some of the written-documentation requirements.

Section 502 of GLBA (codified at 15 U.S.C. § 6802) requires the opt-out notice. Specifically, § 502(b) prohibits a financial institution from sharing non-public personal information with non-affiliated third parties unless it has first given the consumer a clear and conspicuous notice and a reasonable opportunity to opt out. The related disclosure obligations sit in Section 503 (15 U.S.C. § 6803), which requires the initial and annual privacy notices that carry the opt-out. Both are implemented by Regulation P (12 C.F.R. Part 1016), administered by the CFPB.

Under 15 U.S.C. § 6809 and Section 4(k) of the Bank Holding Company Act, any entity significantly engaged in financial activities—including mortgage lending, loan brokering, debt collection, loan servicing, and financial advisory services—is classified as a financial institution under GLBA and must provide privacy notices and Safeguards protection.

GLBA (Gramm-Leach-Bliley Act) governs consumer financial data privacy, opt-out rights, and technical safeguards for non-public personal information (NPI). SOX (Sarbanes-Oxley Act) governs corporate financial reporting, internal accounting controls, and executive accountability to prevent corporate fraud in publicly traded companies.

GLBA regulates non-public personal information held by covered financial institutions and provides a qualified opt-out for some non-affiliated-party sharing. FCRA regulates consumer reports and qualifying consumer reporting agencies, including dispute procedures with statutory conditions. The CCPA contains specific exemptions and limitations for certain financial and consumer-report information, but those are not a blanket exemption for every data point or business activity. Match the request to the source, purpose, provider, and applicable law rather than assuming that one route covers the entire record.